US 12,411,484 B2
System and method for diagnostics and monitoring of anomalies of a cyber-physical system
Andrey B. Lavrentyev, Moscow (RU); Artem M. Vorontsov, Moscow (RU); Dmitry A. Ivanov, Moscow (RU); Vyacheslav I. Shkulev, Moscow (RU); Nikolay N. Demidov, Moscow (RU); Artyom M. Nechiporuk, Moscow (RU); Maxim A. Mamaev, Moscow (RU); and Alexander V. Travov, Moscow (RU)
Assigned to AO Kaspersky Lab, Moscow (RU)
Filed by AO Kaspersky Lab, Moscow (RU)
Filed on Oct. 26, 2022, as Appl. No. 17/973,796.
Claims priority of application No. RU2021139349 (RU), filed on Dec. 28, 2021.
Prior Publication US 2023/0205193 A1, Jun. 29, 2023
Int. Cl. G05B 23/02 (2006.01)
CPC G05B 23/0243 (2013.01) [G05B 23/0216 (2013.01); G05B 23/0221 (2013.01); G05B 23/024 (2013.01); G05B 23/0281 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A method for diagnostics and monitoring of anomalies in a cyber-physical system (CPS), the method comprising:
obtaining information related to anomalies identified in the CPS, wherein the obtained information comprises at least one value of one or more CPS variables;
generating one or more classifying features of the identified anomalies in the CPS based on the obtained information;
performing classification of the identified anomalies in the CPS into two or more anomaly classes based on the generated classifying features, wherein each of the two or more anomaly classes is associated with one or more anomaly characteristics;
performing diagnostics of anomalies in each of the two or more anomaly classes by calculating values of the anomaly characteristics associated with each of the two or more anomaly classes; and
monitoring anomalies of each of the two or more anomaly classes by performing, at a predetermined frequency, at least one of the following types of analyses using the calculated values of the anomaly characteristics associated with each of the two or more anomaly classes:
retrospective analysis of additional characteristics of the two or more anomaly classes for a predetermined historical period of time;
predictive analysis of values of the anomaly characteristics associated with each of the two or more anomaly classes; and
streaming analysis of values of the anomaly characteristics associated with each of the two or more anomaly classes.